The vulnerability is an OS Command Injection that allows unauthenticated local attackers to inject and execute arbitrary OS commands on the server. This flaw grants full control over the underlying operating system, compromising confidentiality, integrity, and availability. The weakness is identified as a classic OS command injection (CWE‑78).

The affected products are HGiga iSherlock‑audit versions 4.5 and 5.5, and HGiga iSherlock‑base versions 4.5 and 5.5. Any installation of these versions is susceptible to the exploit and must be reviewed for a patch.

The CVSS score of 9.3 indicates a high severity level. The EPSS score of 2% shows a low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the absence of listing does not diminish the risk. The flaw requires local, unauthenticated access; an attacker with such access can run arbitrary commands, effectively gaining full control of the affected system. Prompt remediation is essential to mitigate this critical risk.